The Australian Competition and Consumer Commission (ACCC) is urging Australians to verify payment details directly with businesses, particularly those in the real estate and construction sectors. The regulator noted that car dealerships, travel companies, legal firms, and their customers are increasingly targeted by payment redirection scams, also known as “man-in-the-middle” scams.
According to the ACCC, an Australian man recently lost over $35,000 after scammers hacked into the email account of the car dealership from which he was purchasing a car. Despite initially paying the deposit securely through the dealership’s official website, he later received an email with an invoice for the remaining amount owed. Believing the email to be genuine, he paid the invoice. When he went to collect his new car, he discovered that the invoice was a scam and that the dealership had only received his deposit.
Last year, Australians reported losing $16.2 million to payment redirection scams1. Despite the number of reports to Scamwatch decreasing by 28%, the total amount lost increased by 3%, indicating that Australians lost significantly more money per scam last year compared to 2022.
“Scammers are sophisticated criminals and are becoming more targeted in how they exploit Australian consumers and businesses,” ACCC Deputy Chair Catriona Lowe said. “These criminals are posing as genuine businesses that a consumer has recently dealt with, sending fake invoices with altered payment details so that the money ends up with the scammer.”
Detecting payment redirection scams for consumers can be challenging because the criminals often hack into the business’s email system or impersonate the business’s email address by altering just a single letter.
How the scam works.
An email arrives from a business you are dealing with, and you are expecting an invoice. By paying the invoice, you believe the payment is going to the company. However, scammers have gained access to the business email account or altered the email address and modified the payment details on the invoice (BSB and account number). As a result, the payment goes to the scammer instead of the actual business.
Typically, nothing seems unusual until you receive a demand for payment from the business for an invoice you believe you already paid. If you query the change to the payment details on the invoice by responding to the email, the scammer will reply and justify the change.
How a retiree lost a home deposit.
Payment redirection scams can also work in reverse. According to a recent media report, a retiree lost almost $30,000 to scammers when she sold an apartment in June. While she received most of the sale proceeds, her real estate agent inadvertently transferred the deposit paid by the purchaser to a scammer. In this instance, the scammers had hacked into the real estate agent’s email account. Then, they impersonated the business by sending emails from a nearly identical email address to the property vendor.
This incident highlights the importance of verifying payment details with a business over the phone, whether you’re selling an apartment or paying for an overseas holiday. In this case, financial losses could have been prevented if the real estate agent had confirmed the details by phone with the property seller. This situation also underscores the need for extra caution and direct communication to avoid similar financial losses.
How to protect yourself from payment redirection scams.
Don’t rush to act.
- When making payments, especially large sums, take the time to call the business you are dealing with using independently sourced contact details.
- Verify over the phone that the payment details are correct.
Question the legitimacy.
- Ask yourself if you know who you are communicating with.
- Scammers can make invoices appear legitimate by copying logos and ABNs.
- Be cautious of emails that appear to be from the business you have been dealing with but have altered banking details on invoices.
Act quickly if something feels wrong.
- Contact your financial institution immediately if you have shared financial information or transferred money.
- Help others by reporting the scam to Scamwatch.
Would you like to learn more?
Educate yourself on how to keep your money safe from scammers.
Read our series of blog articles about scams, fraud and security.
Alternatively, talk to our team by calling our Contact Centre on 1800 033 139 or visit your local branch.
1 https://www.accc.gov.au/media-release/beware-of-fake-invoices-from-scammers-impersonating-businesses
Important note: This information is of a general nature and is not intended to be relied on by you as advice in any particular matter. You should contact us at Defence Bank to discuss how this information may apply to your circumstances.
